[DEV] OPPO Find 5 Kernel Source Code Released - Android General

{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Great News for development of Oppo Find 5.
Today after listening to requests of community Oppo decided to release source code for they flagship Oppo Find 5.
This amazing devices costs only 499$ and offers best hardware like S4 Qualcomm, 1080p display, 13MP Exmor RS.
Today, we released the kernel source code for Find 5.
Please find it here: https://github.com/oppo-source
Happy developing!
Click to expand...
Click to collapse

Am i right when i say that this baby has the same hardware as the HTC One ?

HTC One has better CPU which is Qualcomm APQ8064T Snapdragon 600 - 1.7 GHz Krait 300
but GPU is 100% same Adreno 320
Oppo Find 5 has same hardware as Sony Xperia Z (+ a better screen)

Awesome. Thanks Oppo! Its really great that you set up a Git!

Took em' long enough...
It remains to be seen whether or not this actually matches what runs on the device.
Maybe I'll pick one up with my ERD perk... dunno... Looks like it's unavailable in the US anyway. (oppousa.com looks... shady... And has no actual purchase links.)

Entropy512 said:
Took em' long enough...
It remains to be seen whether or not this actually matches what runs on the device.
Maybe I'll pick one up with my ERD perk... dunno... Looks like it's unavailable in the US anyway. (oppousa.com looks... shady... And has no actual purchase links.)
Click to expand...
Click to collapse
if you are looking for a place to buy Oppo you should visit oppostyle.com. It's their official online web store. It's available in US (ships from china)

NODO-GT said:
Great News for development of Oppo Find 5.
Today after listening to requests of community Oppo decided to release source code for they flagship Oppo Find 5.
This amazing devices costs only 499$ and offers best hardware like S4 Qualcomm, 1080p display, 13MP Exmor RS.
Click to expand...
Click to collapse
Made a formal request for a forum,lets see how that goes...
[link]

A forum would be great. This is a nice dev device its already unlocked and ready to go. Good price and developer friendly.
gsmarena - just did a write up on the Source Code Release for the OF5 hopefuly we get our own forum here at XDA.
http://blog.gsmarena.com/kernel-source-code-for-oppo-find-5-released/

Entropy512 said:
Took em' long enough...
It remains to be seen whether or not this actually matches what runs on the device.
Maybe I'll pick one up with my ERD perk... dunno... Looks like it's unavailable in the US anyway. (oppousa.com looks... shady... And has no actual purchase links.)
Click to expand...
Click to collapse
oppostyle.com is where you buy it, its not shady man, you can pay with PayPal or Credit Card so your covered both ways, they already sent out the first batch of devices, They are getting ready to send out the second batch soon hopefully because I'm waiting on mine. They send them from China DHL with free shipping. The price is hard to beat its close to the Nexus range ($499 16GB Unlocked) ($569 for 32GB) works with 3G H+ AT&T or T-Mobile networks.
AndroidAuthority Review
http://www.youtube.com/watch?v=lZ-wX43PFLw

The oppo find5 indeed is an amazing device.
It's better than most flagship phones from known manufacturers and was even released first.
I even considered buying it at the release, but then went for a nexus4..
I think i'd really buy one if there would be official aokp/cm versions and some nice kernel devs..

Great news, thanks;

HELP
[email protected]:~/find5$ make -j4
CHK include/linux/version.h
CHK include/generated/utsrelease.h
make[1]: `include/generated/mach-types.h' is up to date.
CALL scripts/checksyscalls.sh
CHK include/generated/compile.h
AS arch/arm/kernel/entry-armv.o
CC arch/arm/common/vic.o
arch/arm/kernel/entry-armv.S:22:30: fatal error: mach/entry-macro.S: No such file or directory
compilation terminated.
make[1]: *** [arch/arm/kernel/entry-armv.o] Error 1
make: *** [arch/arm/kernel] Error 2
make: *** Waiting for unfinished jobs....
CC arch/arm/common/icst.o
CC arch/arm/mm/rodata.o
arch/arm/common/vic.c: In function ‘vic_init2’:
arch/arm/common/vic.c:80:3: error: implicit declaration of function ‘uncached_logk’ [-Werror=implicit-function-declaration]
arch/arm/common/vic.c:80:3: error: ‘LOGK_WRITEL’ undeclared (first use in this function)
arch/arm/common/vic.c:80:3: note: each undeclared identifier is reported only once for each function it appears in
arch/arm/common/vic.c:80:3: error: ‘ETB_WAYPOINT’ undeclared (first use in this function)
arch/arm/common/vic.c:80:1: error: ‘LOG_BARRIER’ undeclared (first use in this function)
arch/arm/common/vic.c: In function ‘resume_one_vic’:
arch/arm/common/vic.c:96:2: error: ‘LOGK_WRITEL’ undeclared (first use in this function)
arch/arm/common/vic.c:96:2: error: ‘ETB_WAYPOINT’ undeclared (first use in this function)
arch/arm/common/vic.c:96:1: error: ‘LOG_BARRIER’ undeclared (first use in this function)
arch/arm/common/vic.c: In function ‘suspend_one_vic’:
arch/arm/common/vic.c:123:20: error: ‘LOGK_READL’ undeclared (first use in this function)
arch/arm/common/vic.c:123:20: error: ‘ETB_WAYPOINT’ undeclared (first use in this function)
arch/arm/common/vic.c:123:20: error: ‘LOG_BARRIER’ undeclared (first use in this function)
arch/arm/common/vic.c:131:2: error: ‘LOGK_WRITEL’ undeclared (first use in this function)
arch/arm/common/vic.c: In function ‘vic_ack_irq’:
arch/arm/common/vic.c:203:2: error: ‘LOGK_WRITEL’ undeclared (first use in this function)
arch/arm/common/vic.c:203:2: error: ‘ETB_WAYPOINT’ undeclared (first use in this function)
arch/arm/common/vic.c:203:1: error: ‘LOG_BARRIER’ undeclared (first use in this function)
arch/arm/common/vic.c: In function ‘vic_mask_irq’:
arch/arm/common/vic.c:212:2: error: ‘LOGK_WRITEL’ undeclared (first use in this function)
arch/arm/common/vic.c:212:2: error: ‘ETB_WAYPOINT’ undeclared (first use in this function)
arch/arm/common/vic.c:212:1: error: ‘LOG_BARRIER’ undeclared (first use in this function)
arch/arm/common/vic.c: In function ‘vic_unmask_irq’:
arch/arm/common/vic.c:219:2: error: ‘LOGK_WRITEL’ undeclared (first use in this function)
arch/arm/common/vic.c:219:2: error: ‘ETB_WAYPOINT’ undeclared (first use in this function)
arch/arm/common/vic.c:219:1: error: ‘LOG_BARRIER’ undeclared (first use in this function)
arch/arm/common/vic.c: In function ‘vic_disable’:
arch/arm/common/vic.c:270:2: error: ‘LOGK_WRITEL’ undeclared (first use in this function)
arch/arm/common/vic.c:270:2: error: ‘ETB_WAYPOINT’ undeclared (first use in this function)
arch/arm/common/vic.c:270:1: error: ‘LOG_BARRIER’ undeclared (first use in this function)
arch/arm/common/vic.c: In function ‘vic_clear_interrupts’:
arch/arm/common/vic.c:281:2: error: ‘LOGK_WRITEL’ undeclared (first use in this function)
arch/arm/common/vic.c:281:2: error: ‘ETB_WAYPOINT’ undeclared (first use in this function)
arch/arm/common/vic.c:281:1: error: ‘LOG_BARRIER’ undeclared (first use in this function)
arch/arm/common/vic.c:285:11: error: ‘LOGK_READL’ undeclared (first use in this function)
arch/arm/common/vic.c: In function ‘vic_init_st’:
arch/arm/common/vic.c:335:4: error: ‘LOGK_WRITEL’ undeclared (first use in this function)
arch/arm/common/vic.c:335:4: error: ‘ETB_WAYPOINT’ undeclared (first use in this function)
arch/arm/common/vic.c:335:1: error: ‘LOG_BARRIER’ undeclared (first use in this function)
arch/arm/common/vic.c: In function ‘__vic_init’:
arch/arm/common/vic.c:357:14: error: ‘LOGK_READL’ undeclared (first use in this function)
arch/arm/common/vic.c:357:14: error: ‘ETB_WAYPOINT’ undeclared (first use in this function)
arch/arm/common/vic.c:357:14: error: ‘LOG_BARRIER’ undeclared (first use in this function)
arch/arm/common/vic.c: In function ‘handle_one_vic’:
arch/arm/common/vic.c:439:17: error: ‘LOGK_READL’ undeclared (first use in this function)
arch/arm/common/vic.c:439:17: error: ‘ETB_WAYPOINT’ undeclared (first use in this function)
arch/arm/common/vic.c:439:17: error: ‘LOG_BARRIER’ undeclared (first use in this function)
cc1: some warnings being treated as errors
make[1]: *** [arch/arm/common/vic.o] Error 1
make[1]: *** Waiting for unfinished jobs....
AS arch/arm/mm/abort-ev5tj.o
make: *** [arch/arm/common] Error 2
AS arch/arm/mm/pabort-legacy.o
CC arch/arm/mm/copypage-v4wb.o
AS arch/arm/mm/tlb-v4wbi.o
arch/arm/mm/rodata.c: In function ‘set_page_attributes’:
arch/arm/mm/rodata.c:91:4: warning: format ‘%lx’ expects argument of type ‘long unsigned int’, but argument 4 has type ‘pmd_t’ [-Wformat]
error, forbidden warning: rodata.c:91
make[1]: *** [arch/arm/mm/rodata.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [arch/arm/mm] Error 2
make: *** wait: No child processes. Stop.
[email protected]:~/find5$ make mrproper
CLEAN .
CLEAN .tmp_versions
CLEAN scripts/basic
CLEAN scripts/dtc
CLEAN scripts/genksyms
CLEAN scripts/kconfig
CLEAN scripts/mod
CLEAN scripts/selinux/genheaders
CLEAN scripts/selinux/mdp
CLEAN scripts
CLEAN include/config include/generated arch/arm/include/generated
CLEAN .config .config.old .version include/linux/version.h
[email protected]:~/find5$
btw thanks OPPO for this source
i got error when i compiled this source .:crying:
sorry bad english

Related

[ROM] pffmod Revoke permissions and Privacy mode. New permissions supported

New permissions with privacy mode support
Any way there is a new build this one is based on the latest and greatest from CM 7.1. the download link is below.
Privacy mode permissions:
NEW! READ_LOGS - If enabled attempts to read logs will return nothing but will not crash the app.
NEW! READ_HISTORY_BOOKMARKS - If enabled it will return the default bookmarks as you have never changed them and empty history.
READ_PHONE_STATE - You can now make your device return anonymized data from the methods protected with READ_PHONE_STATE permission.
There is a demo app
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
you can use to see the effect of the privacy mode and revoking. Run the app revoke or make private run the app again.
Currently there is no READ_LOGS demo.
ROM info:
Some applications may not work properly with revoked permissions.
You CAN'T revoke permission of SYSTEM applications!
If an application is running changing some permissions like say INTERNET will not be fully applied until the application is restarted.
Google apps are not included. You need to download them separately and flash them right after the ROM.
You uses it at your own risk and I cannot be held responsible for the consequences.
Some technical stuff:
If an application checks for its permissions it will appear that all required permissions are granted. This is done to keep some ad networks code happy. As far as I've tested this is safe since the permission check is done at the remote end of the call when protected method is invoked. Please report your findings.
Download:
update-pffmod-7.1.0-DesireHD-20111013-signed.zip
Old builds:
update-pffmod-7.1.0-DesireHD-KANG-signed.zip
direct link: update-pffmod-0.9.1-DesireHD-DEV-20110418-signed.zip storage provided by: http://onlinestoragesolution.com
direct link: update-pffmod-0.9.0-DesireHD-DEV-20110328.2-signed.zip storage provided by: http://onlinestoragesolution.com
update-pffmod-0.9.0-DesireHD-DEV-20110327-signed.zip - broken don't use
update-pffmod-0.9.0-DesireHD-DEV-20110323-signed.zip
update-pffmod-0.9.0-DesireHD-DEV-20110321-signed.zip
update-pffmod-0.9.0-DesireHD-DEV-20110318-signed.zip
update-pffmod-0.9.0-DesireHD-DEV-signed.zip
I need you opinion.
Please comment if you are interested in continued development of this ROM.
Please report ANY success or failure!
This is ingenious, please submit it to the cyanogenmod gerrit if you can.
+1, Using it now, brilliant. It has made me aware of some dodgy permissions out there, although it may cause severe paranoia! Great idea, and think you should continue, a Pure Aosp build would be amazing.
Thanks , and keep going!
I've submitted it to the cyanogenmod gerrit. However this does not mean that it will be accepted.
So for the now I'll try to make daily builds.
lol! nice idea. it'd be great if they'd accept it into the cyanogen nighties. great feature.
Good luck. Cracking feature.
Fantastic, hope it gets approved. Good job!
I've uploaded new build. GPS seams more reliable now.
Is there any kind of delay with re-granting a permission once its been revoked? I've found that re-granting permission is buggy with certain apps.
I've also had some issues building this mod into roms for Inc and Evo, I get this error:
make: *** [out/target/product/inc/obj/SHARED_LIBRARIES/libaudio_intermediates/AudioHardware.o] Error 1
make: *** Waiting for unfinished jobs....
external/bluetooth/bluez/audio/liba2dp.c: In function 'a2dp_write':
external/bluetooth/bluez/audio/liba2dp.c:1204: warning: passing argument 6 of 'sbc_encode' from incompatible pointer type
external/bluetooth/bluez/audio/../sbc/sbc.h:94: note: expected 'ssize_t *' but argument is of type 'unsigned int *'
frameworks/base/services/audioflinger/AudioFlinger.cpp: In member function 'android::status_t android::AudioFlinger::moveEffectChain_l(int, android::AudioFlinger:laybackThread*, android::AudioFlinger:laybackThread*, bool)':
frameworks/base/services/audioflinger/AudioFlinger.cpp:4986: warning: 'strategy' may be used uninitialized in this function
frameworks/base/services/audioflinger/AudioFlinger.cpp: In member function 'virtual android::sp<android::IEffect> android::AudioFlinger::createEffect(pid_t, effect_descriptor_t*, const android::sp<android::IEffectClient>&, int32_t, int, int, android::status_t*, int*, int*)':
frameworks/base/services/audioflinger/AudioFlinger.cpp:4842: warning: 'd.effect_descriptor_s::flags' may be used uninitialized in this function
gandhisfist said:
Is there any kind of delay with re-granting a permission once its been revoked? I've found that re-granting permission is buggy with certain apps.
Click to expand...
Click to collapse
Have you tried force stopping the application and starting it again?
Which are the applications that you have problems with?
gandhisfist said:
I've also had some issues building this mod into roms for Inc and Evo, I get this error:
make: *** [out/target/product/inc/obj/SHARED_LIBRARIES/libaudio_intermediates/AudioHardware.o] Error 1
make: *** Waiting for unfinished jobs....
external/bluetooth/bluez/audio/liba2dp.c: In function 'a2dp_write':
external/bluetooth/bluez/audio/liba2dp.c:1204: warning: passing argument 6 of 'sbc_encode' from incompatible pointer type
external/bluetooth/bluez/audio/../sbc/sbc.h:94: note: expected 'ssize_t *' but argument is of type 'unsigned int *'.....
Click to expand...
Click to collapse
Sorry but this errors are not related to the pffmod sources try to first sync then clean and rebuild.
Updated. The last one had its video playback broken... sorry for that.
Absolutely brilliant! I pray to god somebody incorporates this into a sense ROM.
I've been contacted by Google. The offered me a job if I stop developing the pffmod.
What should I do?
username666 said:
I've been contacted by Google. The offered me a job if I stop developing the pffmod.
What should I do?
Click to expand...
Click to collapse
haha noway! Noone is fooling me today!! Especially today!!
But anyway, if its true, im congratulating you, the idea is insanely great, and i only wish it was Sense compatible..
Halleluja to you
Now no one will fall for it
Dude, just want to express my gratitude again for this amazing feature, i refuse to install a rom that doesn't have it, its pretty much my favorite feature right now and i don't see anythign else topping it anytime soon. Well done sir, you are a gentleman and a scholar.
Great Idea.

When is CM7 coming out?

Well, now that I have your attention, my REAL question is this: Is there a way to make apps like the Amazon marketplace think they're on wifi so I don't get that stupid "you can't download this because it's too big for a cellular network"?
***** please, I pay for unlimited data and I plan to use it.
Sent from my Droid Charge running Infinity Beta
HAHAHA I like your tactics for getting attention.
A while back I made a remark that the only way to get peoples attention in these forums is to ask if CM7 is coming out in the title and then ask the real question in the body.
Well played
Also no, there's no way to trick Amazon
I've actually been working on figuring out a way to do this.
Any app that tries to figure out how it's connected queries the same class in the system called NetworkInfo.class.
There are two methods within NetworkInfo.class that report the network type: getType() and getTypeName(). getType() returns a machine-readable answer, while getTypeName() is human-readable.
Code:
public int getType() {
return mNetworkType;
}
Code:
public String getTypeName() {
switch (mNetworkType) {
case ConnectivityManager.TYPE_WIFI:
return "WIFI";
case ConnectivityManager.TYPE_MOBILE:
return "MOBILE";
default:
return "<invalid>";
}
}
I haven't had the resources (primarily time) to dig that far into things, but if we could figure out a way to inject something between Amazon and the getType() or getTypeName() calls, we could report to it that we're on WiFi regardless of how we're actually connected.
AlexDeGruven said:
I've actually been working on figuring out a way to do this.
Any app that tries to figure out how it's connected queries the same class in the system called NetworkInfo.class.
There are two methods within NetworkInfo.class that report the network type: getType() and getTypeName(). getType() returns a machine-readable answer, while getTypeName() is human-readable.
Code:
public int getType() {
return mNetworkType;
}
Code:
public String getTypeName() {
switch (mNetworkType) {
case ConnectivityManager.TYPE_WIFI:
return "WIFI";
case ConnectivityManager.TYPE_MOBILE:
return "MOBILE";
default:
return "";
}
}
I haven't had the resources (primarily time) to dig that far into things, but if we could figure out a way to inject something between Amazon and the getType() or getTypeName() calls, we could report to it that we're on WiFi regardless of how we're actually connected.
Click to expand...
Click to collapse
Wow, Computer Science II is actually helping me be able to read this. So, what type of object is mNetworkType and where is it defined? We could get it to just return that its on wifi all the time. Also, do you know what Amazon calls? GetType or GetTypeName?
Sent from my Droid Charge running Infinity Beta
Lol. Nicely done with the thread title.
Sent from my mobile office.
AlexDeGruven said:
I've actually been working on figuring out a way to do this.
Any app that tries to figure out how it's connected queries the same class in the system called NetworkInfo.class.
There are two methods within NetworkInfo.class that report the network type: getType() and getTypeName(). getType() returns a machine-readable answer, while getTypeName() is human-readable.
Code:
public int getType() {
return mNetworkType;
}
Code:
public String getTypeName() {
switch (mNetworkType) {
case ConnectivityManager.TYPE_WIFI:
return "WIFI";
case ConnectivityManager.TYPE_MOBILE:
return "MOBILE";
default:
return "<invalid>";
}
}
I haven't had the resources (primarily time) to dig that far into things, but if we could figure out a way to inject something between Amazon and the getType() or getTypeName() calls, we could report to it that we're on WiFi regardless of how we're actually connected.
Click to expand...
Click to collapse
kvswim said:
Wow, Computer Science II is actually helping me be able to read this. So, what type of object is mNetworkType and where is it defined? We could get it to just return that its on wifi all the time. Also, do you know what Amazon calls? GetType or GetTypeName?
Sent from my Droid Charge running Infinity Beta
Click to expand...
Click to collapse
Interesting stuff. There's an iPhone app for jailbroken phones that performs this function on an app-by-app basis. With this code identified, something similar might be possible on Android. I haven't done any Android dev yet, so I don't know how much help I might be. Is there a way to easily (and cheaply) intercept method calls on Android? If so, there might be a way to intercept the getType and getTypeName calls and then modify them on a case-by-case basis so that the call can be diverted to a different function. I'm talking completely theoretical here...I don't know what is offered by the Android SDK.
shrike1978 said:
Interesting stuff. There's an iPhone app for jailbroken phones that performs this function on an app-by-app basis. With this code identified, something similar might be possible on Android. I haven't done any Android dev yet, so I don't know how much help I might be. Is there a way to easily (and cheaply) intercept method calls on Android? If so, there might be a way to intercept the getType and getTypeName calls and then modify them on a case-by-case basis so that the call can be diverted to a different function. I'm talking completely theoretical here...I don't know what is offered by the Android SDK.
Click to expand...
Click to collapse
That was exactly where my investigation has hit the wall at the moment (and then I got busy finishing my basement).
There are a couple of ways to do it, really. Someone could modify the appstore apk to wrap any calls to getType() and getTypeName(), but that would only be on that particular apk. IIRC, the market does it for large apk downloads as well.
Other apps also look at what your network type is.
I'd love to have something that allows me to toggle what the applications see, regardless of the actual state (I'm thinking of things like Verizon's Skype, etc).
The problem with all of this is that NetworkInfo.class is deep in the core OS, so intercepting any calls to it's methods might be rather difficult at best.
Edit: Also - Can we change the thread title now that we know what it's really all about?
ROTFLMFAO! Awesome thread title!
Sent from my SCH-I510 using xda premium
rofl you got me!!! hahahaha... and to answer your question I don't think there is but it'd be nice to know for sure
blazing through on my 4G Droid Charge
In the Amazon Appstore apk, com.amazon.mas.client.framework.net contains a class called NetworkStateManager whose source is:
Code:
package com.amazon.mas.client.framework.net;
import android.content.BroadcastReceiver;
import android.content.Context;
import android.content.Intent;
import android.content.IntentFilter;
import android.net.ConnectivityManager;
import android.net.NetworkInfo;
import android.net.wifi.WifiManager;
import android.net.wifi.WifiManager.WifiLock;
import android.os.Handler;
import android.os.Message;
import android.util.Log;
import java.lang.ref.WeakReference;
import java.util.ArrayList;
import java.util.Iterator;
import java.util.List;
import java.util.Map;
import java.util.concurrent.ConcurrentHashMap;
public class NetworkStateManager
{
private static final int DELAY_DROP_DETECTION = 5000;
private static final String TAG = "NetworkStateManager";
private static final Map<String, WifiManager.WifiLock> wifiLocks = new ConcurrentHashMap();
private final ConnectivityManager connectivityManager;
private final WeakReference<Context> context;
private final Handler delayHandler;
private final List<NetworkStateListener> listeners = new ArrayList();
private boolean networkDropDetected = false;
private NetworkStateReceiver receiver = null;
private boolean wasConnected = false;
private final WifiManager wifiManager;
public NetworkStateManager(Context paramContext)
{
this.context = new WeakReference(paramContext);
this.wifiManager = ((WifiManager)paramContext.getSystemService("wifi"));
this.connectivityManager = ((ConnectivityManager)paramContext.getSystemService("connectivity"));
this.delayHandler = new NetworkStateHandler(null);
if (isNetworkConnected());
for (boolean bool = false; ; bool = true)
{
this.networkDropDetected = bool;
return;
}
}
private WifiManager.WifiLock getWifiLock(String paramString)
{
if (wifiLocks.containsKey(paramString));
for (WifiManager.WifiLock localWifiLock = (WifiManager.WifiLock)wifiLocks.get(paramString); ; localWifiLock = this.wifiManager.createWifiLock(paramString))
return localWifiLock;
}
public boolean acquireWifiLock(String paramString)
{
WifiManager.WifiLock localWifiLock = getWifiLock(paramString);
if (localWifiLock.isHeld())
Log.w("NetworkStateManager", "Wifi lock identified by " + paramString + " already acquired");
for (int i = 0; ; i = 1)
{
return i;
localWifiLock.acquire();
wifiLocks.put(paramString, localWifiLock);
}
}
public void addListener(NetworkStateListener paramNetworkStateListener)
{
if (!this.listeners.contains(paramNetworkStateListener))
this.listeners.add(paramNetworkStateListener);
}
public void clearListeners()
{
this.listeners.clear();
}
public boolean isNetworkConnected()
{
NetworkInfo localNetworkInfo = this.connectivityManager.getActiveNetworkInfo();
if ((localNetworkInfo == null) || (!localNetworkInfo.isConnected()));
for (int i = 0; ; i = 1)
return i;
}
public boolean isNetworkWifi()
{
return this.connectivityManager.getNetworkInfo(1).isConnected();
}
public boolean isWifiLockAcquired(String paramString)
{
WifiManager.WifiLock localWifiLock = getWifiLock(paramString);
if ((localWifiLock != null) && (localWifiLock.isHeld()));
for (int i = 1; ; i = 0)
return i;
}
public void releaseWifiLock(String paramString)
{
WifiManager.WifiLock localWifiLock = getWifiLock(paramString);
if (localWifiLock.isHeld())
{
localWifiLock.release();
if (wifiLocks.containsKey(paramString))
wifiLocks.remove(paramString);
}
while (true)
{
return;
Log.w("NetworkStateManager", "Wifi lock identified by " + paramString + " is not acquired");
}
}
public void removeListener(NetworkStateListener paramNetworkStateListener)
{
this.listeners.remove(paramNetworkStateListener);
}
public void startListening()
{
Context localContext = (Context)this.context.get();
if (this.receiver != null)
Log.w("NetworkStateManager", "Already listening, duplicate call to NetworkStateManager#startListening");
while (true)
{
return;
if (localContext == null)
{
Log.w("NetworkStateManager", "Call to NetworkStateManager#startListening on null context");
continue;
}
this.wasConnected = isNetworkConnected();
IntentFilter localIntentFilter = new IntentFilter("android.net.conn.CONNECTIVITY_CHANGE");
this.receiver = new NetworkStateReceiver(null);
localContext.registerReceiver(this.receiver, localIntentFilter);
}
}
public void stopListening()
{
Context localContext = (Context)this.context.get();
if (this.receiver == null)
Log.w("NetworkStateManager", "Not listening, invalid call to NetworkStateManager#stopListening");
while (true)
{
return;
if (localContext == null)
{
Log.w("NetworkStateManager", "Call to NetworkStateManager#stopListening on null context");
continue;
}
localContext.unregisterReceiver(this.receiver);
this.receiver = null;
this.delayHandler.removeMessages(65536);
}
}
private class NetworkStateHandler extends Handler
{
public static final int MSG_NETWORK_DROP = 65536;
private NetworkStateHandler()
{
}
public void handleMessage(Message paramMessage)
{
switch (paramMessage.what)
{
default:
super.handleMessage(paramMessage);
case 65536:
}
while (true)
{
return;
NetworkStateManager.this.wasConnected = false;
NetworkStateManager.this.networkDropDetected = true;
Iterator localIterator = NetworkStateManager.this.listeners.iterator();
while (localIterator.hasNext())
((NetworkStateManager.NetworkStateListener)localIterator.next()).onConnectivityLost();
}
}
}
public static abstract interface NetworkStateListener
{
public abstract void onConnectivityLost();
public abstract void onConnectivityRestored();
}
private class NetworkStateReceiver extends BroadcastReceiver
{
private NetworkStateReceiver()
{
}
public void onReceive(Context paramContext, Intent paramIntent)
{
if ((paramContext == null) || (paramIntent == null) || (!"android.net.conn.CONNECTIVITY_CHANGE".equals(paramIntent.getAction())));
while (true)
{
return;
if (NetworkStateManager.this.isNetworkConnected());
for (int i = 0; ; i = 1)
{
boolean bool = paramIntent.getBooleanExtra("isFailover", false);
if ((i == 0) || (bool) || (!NetworkStateManager.this.wasConnected))
break label99;
Message localMessage = NetworkStateManager.this.delayHandler.obtainMessage(65536);
NetworkStateManager.this.delayHandler.sendMessageDelayed(localMessage, 5000L);
break;
}
label99: if (i != 0)
continue;
if (NetworkStateManager.this.delayHandler.hasMessages(65536))
NetworkStateManager.this.delayHandler.removeMessages(65536);
if (!NetworkStateManager.this.networkDropDetected)
continue;
NetworkStateManager.this.wasConnected = true;
Iterator localIterator = NetworkStateManager.this.listeners.iterator();
while (localIterator.hasNext())
((NetworkStateManager.NetworkStateListener)localIterator.next()).onConnectivityRestored();
}
}
}
}
I'm guessing that making isNetworkWifi() return true would allow for downloads of large files over the cell network. I might repack the APK and post it here if I find the time.
All right, I decompiled the dex file into smali class files, made the change, recompiled, and produced an APK that does not have the wifi restriction, but I'm having problems with signing. I ran a signing tool on the APK, but even after that my phone still fails to install the app (I do have the previous version of the app uninstalled). Has anyone else had experience with this?
substanceD said:
All right, I decompiled the dex file into smali class files, made the change, recompiled, and produced an APK that does not have the wifi restriction, but I'm having problems with signing. I ran a signing tool on the APK, but even after that my phone still fails to install the app (I do have the previous version of the app uninstalled). Has anyone else had experience with this?
Click to expand...
Click to collapse
Care to post it?
Sent from my Droid Charge running Infinity Beta
kvswim said:
Care to post it?
Sent from my Droid Charge running Infinity Beta
Click to expand...
Click to collapse
Yeah, sure. (For anyone else attempting to download this, it will not install in its current form).
Anyone have any luck with the signing?
AlexDeGruven said:
Anyone have any luck with the signing?
Click to expand...
Click to collapse
I'm having troubles too. Is there any way to bypass the sign check? I assume its similar to a CRC or MD5 check.
EDIT: http://developer.android.com/guide/publishing/app-signing.html
What if you saved & signed as a different app name?
Sent from my Droid Charge running Infinity Beta
Bumping
Sent from my Droid Charge running Infinity Beta
Just had an idea. What if we packed it into a ROM as a system APK?
Sent from my Droid Charge running Infinity Beta
Screw CM7. Why was CM8 skipped?! >:[
Sent from my SCH-I510 using xda premium
DirgeExtinction said:
Screw CM7. Why was CM8 skipped?! >:[
Sent from my SCH-I510 using xda premium
Click to expand...
Click to collapse
Great job reading the thread and making a relevant comment.
Aside from that: CM8 would be Honeycomb-based if it were to ever be made, which is unlikely, since it's the one version of Android that's closed-source. ICS will give rise to CM9
AlexDeGruven said:
Great job reading the thread and making a relevant comment.
Aside from that: CM8 would be Honeycomb-based if it were to ever be made, which is unlikely, since it's the one version of Android that's closed-source. ICS will give rise to CM9
Click to expand...
Click to collapse
Why, thank you.
I was bored and just posted that. I knew this thread was about the Amazon appstore(had read some posts from the first page a few days ago).
Sent from my SCH-I510 using xda premium

[TUT] Extend your HelloWorld App Step by Step with a Toast Message

Hi guys, this Tutorial is mainly intended for looking into some other concepts like GUI of Android development. The concept of "Toast" would be actually covered.
First you have to do this (Create a HelloWorld app) : [TUT] Making a HelloWorld App Step by Step w/pictures. - Tutorial created by rezo609
After you've created your first HelloWorld app, its time for some additional tasks!
(NOTE:- Make sure you've set your AVD already)
I know some of you guys are wondering what a Toast is, well here's the answer: Click Me!
Starting development :
Step 1: The first thing we are going to accomplish is changing the strings.xml (Path:- AppName > res > values > strings.xml) file to add another node under app_name. We will do this by copying the node above it and pasting the copied material directly under the last </string> element. Then we will change the name of the string to press and in between we will write Press Me!. Next we will alter the hello node and change the text to say Enter Your Name Here: instead of Hello Android, Hello World!.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Click to expand...
Click to collapse
Step 2: Next step, is to design the GUI (Graphical User Interface). To do this navigate to main.xml (Path:- AppName > res > layout > main.xml) and we are going to go over what everything does up to this point. Set your main.xml file as shown in the below picture.
Make sure you've set the Orientation as vertical, otherwise ie, if its horizontal maybe the GUI controls won't be shown when the app is run.(in an HVGA Emulator, or maybe its me) Anyways you are free to toggle between vertical/horizontal and see what happens.
Click to expand...
Click to collapse
Step 3: Now this is a tricky step, and it includes Java code modifications. I suggest you to google to know exactly what all these codes means be it functions, classes, methods, objects or imports. You can refer the Wiki or the Oracle docs if you want to learn more about Java. Anyways for keeping this Tutorial simple, just modify the Java file (Path:- AppName > src > com.example.helloworld > HelloWorldActivity.java) as shown in the below picture.
I'll also give it as CODE, but don't just copy-paste. If you run into massive errors or problems only, do that. Its better to type the codes by yourself and see what all AutoFill options/suggestions are given by Eclipse. Anyways try to correct the errors by yourself, it maybe only a spelling-mistake, but you have to identify it where.
Code:
package com.example.helloworld;
import android.app.Activity;
import android.os.Bundle;
import android.widget.Button;
import android.widget.EditText;
import android.widget.Toast;
import android.view.View.OnClickListener;
import android.content.Context;
import android.view.View;
public class HelloWorldActivity extends Activity {
EditText helloName;
/** Called when the activity is first created. */
@Override
public void onCreate(Bundle savedInstanceState) {
super.onCreate(savedInstanceState);
setContentView(R.layout.main);
// Capture our button from layout
Button button = (Button)findViewById(R.id.go);
// Register the onClickListener with the implementation above
button.setOnClickListener(maddListener);
}
// Create an anonymous implementation of OnClickListener
private OnClickListener maddListener = new OnClickListener() {
public void onClick(View v) {
long id = 0;
// Do something when the button is clicked
try {
helloName = (EditText)findViewById(R.id.helloName);
Context context = getApplicationContext();
CharSequence text = "Hello " + helloName.getText() +"!";
int duration = Toast.LENGTH_LONG;
Toast toast = Toast.makeText(context, text, duration);
toast.show();
}
catch(Exception e) {
Context context = getApplicationContext();
CharSequence text = e.toString() + "ID = " + id;
int duration = Toast.LENGTH_LONG;
Toast toast = Toast.makeText(context, text, duration);
toast.show();
}
}
};
}
Click to expand...
Click to collapse
Step 4: After doing all these above mentioned tasks, its time for the output. Be sure to click "Save All" (Ctrl+Shift+S) button in the Eclipse. Also make sure your Project is free from errors, otherwise it would not run. You can also clean your Project (Some errors maybe automatically fixed) by navigating to Project > Clean...
Right Click your Project > Run As > 1 Android Application
Your Emulator would start, and you'll see in the Eclipse as apk installing, running etc..
If your Project is a Success, you'll get the output as shown in the below picture:
Click to expand...
Click to collapse
And that's it
I hope you enjoyed this tutorial. Its made as simple as possible and omitted some theories from the Original source. You can get to it, and see the xml parts explained.
After you have succeeded in this app, head over to next Tutorial : Create your First Widget Step by Step
Thanks for this.
This is great!!
Sent from my HTC Wildfire S using xda premium
Welcome guys, hope you guys tried/will try and get successful.
Tutorial now featured at XDA-Portal : Here
Thanks to the Author.
So I decided to look at this. I've got everything as you have above but I have errors.
Current errors are in the following lines:
Code:
Button button = (Button)findViewById(R.[COLOR="Red"]id[/COLOR].go);
Code:
helloName = (EditText)findViewById(R.[COLOR="red"]id[/COLOR].helloName);
The error states: id cannot be resolved or is not a field
If I follow the listed fixes it places lines in the R.java. However, I then get errors on go and helloName for which there are no listed fixes.
Still looking to see if I can find it myself but wanted to tell you about this to see if it was just me (probably) or a missing section in the info above.
EDIT: Sigh. It's amazing what missing one line will do to you. This was my fault. Forgot to add the Press me string and it created these errors. Working great now.
blazingwolf said:
So I decided to look at this. I've got everything as you have above but I have errors.
Current errors are in the following lines:
Code:
Button button = (Button)findViewById(R.[COLOR="Red"]id[/COLOR].go);
Code:
helloName = (EditText)findViewById(R.[COLOR="red"]id[/COLOR].helloName);
The error states: id cannot be resolved or is not a field
If I follow the listed fixes it places lines in the R.java. However, I then get errors on go and helloName for which there are no listed fixes.
Still looking to see if I can find it myself but wanted to tell you about this to see if it was just me (probably) or a missing section in the info above.
EDIT: Sigh. It's amazing what missing one line will do to you. This was my fault. Forgot to add the Press me string and it created these errors. Working great now.
Click to expand...
Click to collapse
please check the imports ...
if you find line import android.R; ... remove it and then clean build....
blazingwolf said:
EDIT: Sigh. It's amazing what missing one line will do to you. This was my fault. Forgot to add the Press me string and it created these errors. Working great now.
Click to expand...
Click to collapse
There you are
Actually we should edit all the XML files first like android:id="@+id/go" and it will show error in XML file for sure (Because id can't be found anywhere) but finally when you code the java file, and when the id is referenced, all errors will be gone
Anyways the R.java file can't be modified manually. It will revert back to original state if you do so, that is even if you apply the suggested fixes by Eclipse.
pmapma1 said:
please check the imports ...
if you find line import android.R; ... remove it and then clean build....
Click to expand...
Click to collapse
Actually unnecessary imports will not cause the application to malfunction. It will only use more resources based on program. Eclipse will give a warning to remove unused imports, as its not used anywhere.
Hi there,
I've been wondering this so I thought I'd ask here since it seems nice and n00b friendly ;-)
I was wondering if you could tell me if there's any direct benefit to creating an OnClickListener in Java instead of using the android:OnClick="" attribute for the layout and having it go to a specified method.
Thanks,
Tom
TommiTMX said:
Hi there,
I've been wondering this so I thought I'd ask here since it seems nice and n00b friendly ;-)
I was wondering if you could tell me if there's any direct benefit to creating an OnClickListener in Java instead of using the android:OnClick="" attribute for the layout and having it go to a specified method.
Thanks,
Tom
Click to expand...
Click to collapse
Benefit?! ... Hmm !!
It all depends upon the logic of the programmer that he/she is comfortable with. Actually there will be many methods or many ways we can create for the same process. But as this is just a Tutorial/Illustration application, we don't know exactly what its effects. Maybe in real time application there maybe some beneficiaries. Just we need to sort it out to know.
can you make a tutorial how to make a background process? Or service of somekind.
E.g. process that shows blue led while BT is on
thanks in advance!
Shmarkus said:
can you make a tutorial how to make a background process? Or service of somekind.
E.g. process that shows blue led while BT is on
thanks in advance!
Click to expand...
Click to collapse
I'll definitely try, but can't guarantee when because I'm also a learning candidate in Android app development. So making Tutorials, that I've already learned and tried. Once I've learned about it, I'll of course include the Tutorial for it.
why we need try/catch for one-way trigger? ... what in toast can throw exception?
Flowyk said:
why we need try/catch for one-way trigger? ... what in toast can throw exception?
Click to expand...
Click to collapse
Well, I just checked myself by removing the try-catch block, and yes you are right as no exceptions are actually caught. Anyways the code is not actually written by me, and if you checked the original source you'd have known that.
And Thanks for the point mate. Maybe I'll review the code from next time onwards.
np ... im just learning
Error?
FIXXED

Security Exception accessing Content Provider in another application

Hello everybody!
I'm trying to create a content provider usable only by the applications that are signed by the same certificate. I've declared the content provider like this
<provider
android:name=".MyProvider"
android:authorities="com.example.provider"
androidermission="com.example.permissions.USER_PERMISSION"
android:readPermission="com.example.permissions.USER_PERMISSION_READ"
android:writePermission="com.example.permissions.USER_PERMISSION_WRITE"
android:exported="true">
</provider>
I have declared the permissions with signature protection level.
All good but when I try to access the provider from the other application like this:
//Create an URI that will be used to check the status of the content provider
Uri myURI = Uri.parse("content://com.example.provider");
ContentResolver contentResolver = getContentResolver();
try {
contentResolver.insert(prototypeURI,null);
} catch (Exception e) {
e.printStackTrace();
}
I get a SecurityException: Permission Denial: opening provide ... requires com.example.permissions.USER_PERMISSION_READ.
Any ideas?
Solution
I have found the issue.
The main project was configured to create debug builds with a custom signing configuration.

Mediatek Wifi/BT/FM/GPS combo chips, hidden capabilities [MT6620, MT6628, MT6630]

Hi everyone! This is a deep dev-related question, but I don't have permission to post into dev forums.
My goals are - implement Wifi monitor mode and enable FM Transmission capability. Since they are both related to one chip, I decided to put them into one post (sorry if this decision was wrong).
What do we have now:
The chip - general info
Is an ARM7-based SoC, combining features of it's ancestors: WLAN (MT5921), Bluetooth/FM (MT6616) and GPS (MT3326).
I've found the drivers for it in this repo: https://github.com/bq/aquaris-E5, wlan path: mediatek/kernel/drivers/combo/drv_wlan, fm path: mediatek/kernel/drivers/fmradio/mt6620.
There is an NVRAM map here: http://www.datasheet-pdf.com/datasheet-download.php?id=955336
And it's description (with pinout, block chart, but no specific details about it's ARM core): http://www.bluetooth.org/tpg/RefNotes/MT6620_RIN_Product_Brief_20101110.docx
Added: Found out that we cannot trust /system/build.prop for checking out a chip id. Drivers (lsmod) are not good indication either. You can use a built-in ioctl utility to issue a request directly to the chip like this:
Code:
ioctl -l 4 /dev/fm -1073416950
It doesn't parse a proper hex representation of the ioctl (0xС004f519) correctly, so I had to use this signed notation.
Turned out that Philips S388 has MT6627, which doesn't even have an FM Tx block in hardware: http://www.cnping.com/wp-content/uploads/2015/12/MT6627_Data_Sheet_v03a.pdf
Unluckily, my another device (PAP4044 Duo) has an MT6628 chip, which also doesn't support Tx: https://github.com/luckasfb/Develop...s/MT6628/MT6628T_external_datasheet_v1.2b.pdf
But curiously, it doesn't even have FM_IOCTL_TX_SUPPORT ioctl implemented, while S388 responds fine to it. You can check it for your device like this:
Code:
ioctl -l 4 /dev/fm -1073416935
If you get a "01 00 00 00" response, it would mean really good news - that your device supports TX and it is not disabled by the driver!
Wlan - low level packet reading/writing
libhardware_legacy.so on my Philips S388 enables wifi by calling "wifi_change_fw_path", which loads one of the 3 firmware (driver?) flavors: "STA", "STA+P2P" or "AP".
Firmware is located at /etc/firmware/WIFI_RAM_CODE, I attached it to the post.
According to "firmware_download" function, firmwares can be single-chunked (like this one) or have the header described by these structs:
Code:
typedef struct _FWDL_SECTION_INFO_T
{
UINT_32 u4Offset;
UINT_32 u4Reserved;
UINT_32 u4Length;
UINT_32 u4DestAddr;
} FWDL_SECTION_INFO_T;
typedef struct _FIRMWARE_DIVIDED_DOWNLOAD_T
{
UINT_32 u4Signature;
UINT_32 u4CRC; /* CRC calculated without first 8 bytes included */
UINT_32 u4NumOfEntries;
UINT_32 u4Reserved;
FWDL_SECTION_INFO_T arSection[];
} FIRMWARE_DIVIDED_DOWNLOAD_T;
u4Signature is "MTKW" for multi-chunk files. I've attached one of these multi-chunk firmwares also for you to see how they look like.
The chunks themselves look packed/encrypted, no visible headers. Doesn't look like a proper ARM code either.
And this part of code suggests some on-chip encryption (WTF?! It's not a smart-card or crypto chip):
Code:
prInitCmdDownloadBuf->u4DataMode = 0 | 0x1; // enable encryption
Added: Now I'm sure the stuff is encrypted. I've tried to figure out the cipher's specs and think it is either 8-byte block cipher or streaming cipher. Analyzing some datasheets and background info on Mediatek I've narrowed down possible candidates to RC4, DES, 3DES or some makeshift repeating key xor cipher.
I've seen some weird patterns in data like these, enforcing the latter idea:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
But xor'ing different parts together does not break data uniformity. Also a Hamming distance analysis doesn't apply here - it gives a key length of 36 bytes, which doesn't make sense.
If someone's good with crypto, I desperately need your advice.
Added2: I've effectively excluded RC4 as it doesn't produce repeating patterns and 95% sure it is 3DES in EDE mode like this:
Code:
openssl des -e -nosalt -des-ede3 -in plaintext -out 3des.cyp
Also using test mode MCR (MCU Register?) functions, I've managed to dump around 4 megs of something (attached as "something.zip"), which, according to the driver sources, could contain the decrypted firmware at offset 0x60000. And it does, judging by the size of the block and location of some characteristic zero-gaps, but despite of being non-packed and non-crypted, still doesn't make sense as an ARM code.
FM Transmission
Driver contains ioctls for TX mode:
Code:
#define FM_IOCTL_TX_SUPPORT _IOWR(FM_IOC_MAGIC, 25, int32_t*)
#define FM_IOCTL_RDSTX_SUPPORT _IOWR(FM_IOC_MAGIC, 26, int32_t*)
#define FM_IOCTL_RDSTX_ENABLE _IOWR(FM_IOC_MAGIC, 27, int32_t*)
#define FM_IOCTL_TX_SCAN _IOWR(FM_IOC_MAGIC, 28, struct fm_tx_scan_parm*)
And their implementation:
Code:
/*****tx function****/
ops->bi.tx_support = mt6620_Tx_Support;
ops->bi.pwrupseq_tx = mt6620_PowerUpTx;
ops->bi.tune_tx = MT6620_SetFreq_Tx;
ops->bi.pwrdownseq_tx = mt6620_PowerDownTx;
ops->bi.tx_scan = mt6620_TxScan;
Don't worry about TX_SUPPORT, the support availability seems to be out of the question:
Code:
static fm_s32 mt6620_Tx_Support(fm_s32 *sup)
{
*sup=1;
return 0;
}
However, I cannot guarantee the TX is not disabled by firmware (see above). Didn't dig well into this, since this feature is my 2-nd priority.
This is a tough stuff to pull off alone, so I'm looking for those who's interested and willing to join the effort.
ogurets said:
Hi everyone! This is a deep dev-related question, but I don't have permission to post into dev forums.
My goals are - implement Wifi monitor mode and enable FM Transmission capability. Since they are both related to one chip, I decided to put them into one post (sorry if this decision was wrong).
What do we have now:
The chip
Is an ARM7-based SoC, combining features of it's ancestors: WLAN (MT5921), Bluetooth/FM (MT6616) and GPS (MT3326).
I've found the drivers for it in this repo: github.com /bq/aquaris-E5, wlan path: mediatek/kernel/drivers/combo/drv_wlan, fm path: mediatek/kernel/drivers/fmradio/mt6620.
There is an NVRAM map here: datasheet-pdf.com /datasheet-download.php?id=955336
And it's description (with pinout, block chart, but no specific details about it's ARM core): bluetooth.org /tpg/RefNotes/MT6620_RIN_Product_Brief_20101110.docx
Wlan
libhardware_legacy.so on my Philips S388 enables wifi by calling "wifi_change_fw_path", which loads one of the 3 firmware (driver?) flavors: "STA", "STA+P2P" or "AP".
Firmware is located at /etc/firmware/WIFI_RAM_CODE, I attached it to the post.
According to "firmware_download" function, firmwares can be single-chunked (like this one) or have the header described by these structs:
Code:
typedef struct _FWDL_SECTION_INFO_T
{
UINT_32 u4Offset;
UINT_32 u4Reserved;
UINT_32 u4Length;
UINT_32 u4DestAddr;
} FWDL_SECTION_INFO_T;
typedef struct _FIRMWARE_DIVIDED_DOWNLOAD_T
{
UINT_32 u4Signature;
UINT_32 u4CRC; /* CRC calculated without first 8 bytes included */
UINT_32 u4NumOfEntries;
UINT_32 u4Reserved;
FWDL_SECTION_INFO_T arSection[];
} FIRMWARE_DIVIDED_DOWNLOAD_T;
u4Signature is "MTKW" for multi-chunk files. I've attached one of these multi-chunk firmwares also for you to see how they look like.
The chunks themselves look packed/encrypted, no visible headers. Doesn't look like a proper ARM code either.
And this part of code suggests some on-chip encryption (WTF?! It's not a smart-card or crypto chip):
Code:
prInitCmdDownloadBuf->u4DataMode = 0 | 0x1; // enable encryption
FM
Driver contains ioctls for TX mode:
Code:
#define FM_IOCTL_TX_SUPPORT _IOWR(FM_IOC_MAGIC, 25, int32_t*)
#define FM_IOCTL_RDSTX_SUPPORT _IOWR(FM_IOC_MAGIC, 26, int32_t*)
#define FM_IOCTL_RDSTX_ENABLE _IOWR(FM_IOC_MAGIC, 27, int32_t*)
#define FM_IOCTL_TX_SCAN _IOWR(FM_IOC_MAGIC, 28, struct fm_tx_scan_parm*)
And their implementation:
Code:
/*****tx function****/
ops->bi.tx_support = mt6620_Tx_Support;
ops->bi.pwrupseq_tx = mt6620_PowerUpTx;
ops->bi.tune_tx = MT6620_SetFreq_Tx;
ops->bi.pwrdownseq_tx = mt6620_PowerDownTx;
ops->bi.tx_scan = mt6620_TxScan;
Don't worry about TX_SUPPORT, the support availability seems to be out of the question:
Code:
static fm_s32 mt6620_Tx_Support(fm_s32 *sup)
{
*sup=1;
return 0;
}
However, I cannot guarantee the TX is not disabled by firmware (see above). Didn't dig well into this, since this feature is my 2-nd priority.
This is a tough stuff to pull off alone, so I'm looking for those who's interested and willing to join the effort.
Click to expand...
Click to collapse
I'll move it to android development for you unless you'd prefer it to stay in general
Regards
Sawdoctor
Found an interesting test mode in the driver and built a utility from the sources found in public repos around (source code for S388 attached).
It actually sends packets! I were able to capture them with another wifi card, so it's not some internal emulation, it is real.
The capture file is with the sources attached (forum does not allow me to upload .pcap file directly). Contents seem random, but if there is a way to specify a payload, there would be no need to decipher the firmware.
This is how an attached dump were made (used speed setting to confirm those are really my packets, not just random neighborhood traffic):
Code:
# ./wifitesttool -t 0 -s 0 -R 11
(success) Set central channel number to 1
(success) Set Rx default antenna to main
(success) Set bandwidth to BW20
(success) Set Tx power gain to 10 dBm
(success) Set Tx payload to 1024 bytes..
(success) Set frame interval to 20 TU
(success) Set frame count to 10
(success) Set SHORT preamble
(success) Set Tx mode to 11a/b/g, tx rate RATE_48MBPS
no cw mode configuration.
(success) TX test started..
Tx test is running! wait for 10s...
[0] Tx total/good count: 0/0
[1] Tx total/good count: 10/10
[2] Tx total/good count: 10/10
[3] Tx total/good count: 10/10
[4] Tx total/good count: 10/10
[5] Tx total/good count: 10/10
[6] Tx total/good count: 10/10
[7] Tx total/good count: 10/10
[8] Tx total/good count: 10/10
[9] Tx total/good count: 10/10
[10] Tx total/good count: 10/10
Stop Tx test!
Added: This AT command looks promising for setting a payload: RF_AT_FUNCID_PKTCONTENT
Nice
What you are trying to do?
I saw WIFI_RAM_CODE on my mediatek device it's not encrypted
Strings are still in plain text
[email protected] said:
What you are trying to do?
I saw WIFI_RAM_CODE on my mediatek device it's not encrypted
Strings are still in plain text
Click to expand...
Click to collapse
I'm trying to implement a non-associated wireless protocol using the widely available consumer hardware.
Could you post your WIFI_RAM_CODE file and the model of your Wifi chip or device?
Do you mean enabling monitor mode?(or something like that?)
My device has mt6755 WiFi chipset
ogurets said:
I'm trying to implement a non-associated wireless protocol using the widely available consumer hardware.
Could you post your WIFI_RAM_CODE file and the model of your Wifi chip or device?
Click to expand...
Click to collapse
So, can we inject packets?
Can you upload wifitest binary for mt6628?
Is there a way to read fm audio data from mt6627?

Categories

Resources